This Privacy Notice explains how Maple Insights Inc., operating as POPULAB (“POPULAB”, “we”, “us”), handles personal information through populab.ai (the “Website”). Maple Insights Inc. is incorporated under the Canada Business Corporations Act.
Who is accountable
Privacy Officer, Maple Insights Inc.
Email: [email protected]
The Privacy Officer receives privacy questions, access or correction requests, withdrawal requests, and complaints.
Information we handle
Contact inquiries
When you submit the strategic-partner form, we collect your work email address, organization name and type, the product interests you select, and anything you include in the description of your proposed use case. We also record that you consented to our using the submission to answer your inquiry. Please do not include sensitive personal information or confidential respondent data in the form.
Website delivery and security
Cloudflare delivers and protects the Website. Like most hosting and security services, it receives request information such as IP address, browser and device information, requested URL, referrer, and request time. Cloudflare may use strictly necessary security technologies to detect abuse and keep the Website available.
The contact page uses Cloudflare Turnstile to distinguish people from automated traffic. Turnstile processes browser and device signals needed for that security purpose, including technical request information and challenge results. POPULAB receives the validation result, not your form entries through Turnstile. Cloudflare provides aggregate Turnstile statistics that may include country, browser, operating system, network, and high-volume source information.
Real User Measurement
Cloudflare Real User Measurement (RUM) runs on the Website to measure performance and reliability. Its browser script reports page and referrer information, a page-load identifier, timing measurements, Core Web Vitals, and limited information about elements affecting performance. It does not use cookies or browser storage, and we do not use it to recognize people or follow them across websites. Cloudflare states that although the beacon request necessarily reaches it from a source IP address, the RUM service discards that address at the nearest Cloudflare data centre and does not store it in its core databases or logs.
RUM is used only to operate and improve the Website. POPULAB has configured it not to collect measurements from visitors in the European Union or United Kingdom. You may prevent the script from running with browser privacy or script-blocking controls.
We do not use a separate visitor-usage analytics service, advertising cookies, or cross-site advertising technology.
Why we use information
We use personal information only to:
- answer and manage an inquiry you chose to submit;
- deliver, secure, troubleshoot, and measure the performance of the Website;
- prevent fraud, spam, and technical abuse; and
- meet legal obligations or establish, exercise, or defend legal claims.
We do not sell or rent personal information. We do not use it for targeted advertising or disclose it to advertising networks or data brokers.
Consent and choices
Submitting the contact form is optional. The form asks for your consent immediately before submission. You may withdraw that consent by contacting the Privacy Officer. Withdrawal does not invalidate processing already completed and may prevent us from continuing to handle your inquiry.
RUM and necessary security processing are limited to operating the Website and are described here so that you can make an informed choice about visiting. Browser controls can block JavaScript or site data, although doing so may affect the Website or contact form.
Service providers and disclosures
We disclose information only as needed to:
- Cloudflare, for website delivery, security, Turnstile, performance measurement, and email routing;
- Google Workspace, which hosts the receiving POPULAB mailbox, for delivery and storage of contact inquiries;
- professional advisers or authorities when reasonably necessary to comply with law or protect legal rights; and
- a successor in a merger, financing, reorganization, or sale, subject to applicable notice and protection requirements.
Service providers are authorized to process information only for the services they provide to us. Their infrastructure may process information in Canada, the United States, or other countries, where it may be subject to local law. We use provider safeguards and contractual protections appropriate to the information and service.
Retention and safeguards
Inactive contact inquiries are deleted from the receiving mailbox within 12 months. Records connected to an active business relationship, transaction, dispute, or legal obligation may be kept longer, only for as long as that purpose requires. Provider security and performance records follow the provider’s documented retention settings.
We use administrative, technical, and contractual safeguards appropriate to the information, including access restrictions, encrypted transport, anti-automation controls, and restricted form delivery. No Internet transmission or storage system can be guaranteed completely secure.
Your rights
Depending on the law that applies, you may ask us to:
- confirm whether we hold personal information about you;
- provide access to it and explain how it has been used or disclosed;
- correct inaccurate or incomplete information;
- delete information that is no longer required;
- withdraw consent, subject to legal or contractual restrictions; or
- address a privacy complaint.
Send requests to [email protected]. We may request limited information to verify identity and will respond within the period required by applicable law.
Canadian residents may complain to the Office of the Privacy Commissioner of Canada or the appropriate provincial regulator. Quebec residents may also complain to the Commission d’accès à l’information du Québec. Residents of US states with applicable consumer privacy laws may exercise the rights those laws provide. We will not discriminate against anyone for making a valid privacy request.
Because the Website does not sell or share personal information for cross-context behavioural advertising, Global Privacy Control and Do Not Track signals do not require a separate opt-out action on this Website.
Children
The Website is a business-to-business service and is not directed to children. We do not knowingly solicit personal information from children. Contact the Privacy Officer if you believe a child submitted information so we can investigate and delete it where appropriate.
Email communications
We use a submitted email address to answer the inquiry. Form submission does not subscribe you to marketing. If we later send a commercial electronic message where permitted, it will identify the sender and provide the contact information and unsubscribe mechanism required by applicable law.
Changes and contact
We may update this notice when our practices, providers, or legal obligations change. Material changes will be identified on this page. Questions or complaints may be sent to the Privacy Officer using the contact information above.
Effective date: August 31, 2026